---
title: "Network Automation at Fleet Scale"
outcome: "Took a multi-region switch fleet from hand-managed to single-pane — automated config backup, bulk change in minutes, and credentials secured and rotated."
summary: "Productionised a vendor-agnostic network config-management platform (Unimus) with NetBox as the source-of-truth across an AU/NZ/PNG switch fleet: scheduled config backups, mass config push, and a centrally vaulted, rotated credential model — community tooling stood up ground-up under a corporate-supported licence."
role: "Global IT Infrastructure Engineer · Linde Asia Pacific"
period: "2019 – 2022"
stack: ["Unimus (NCM)", "NetBox (IPAM / SoT)", "Config backup & DR", "Bulk config push", "Credential vaulting + rotation", "Multi-vendor switching"]
featured: false
order: 45
cover: "network-automation-fleet"
diagram: "network-fleet"
links:
  - label: "Unimus"
    href: "https://unimus.net"
  - label: "NetBox"
    href: "https://netbox.dev"
---

## Problem

A multi-region switch fleet — Australia, New Zealand and PNG — was maintained by hand.
Configs drifted, backups were "hope someone saved the last one," bulk changes were pushed
box-by-box, and device credentials were scattered across people and scripts. For a network
that production depends on, there was no real recovery path and no audit trail.

## Constraints

- **Live production network** — change the fleet without taking sites down.
- **Mixed-vendor estate** — the tooling had to be vendor-agnostic, not tied to one OS.
- **Credentials are the crown jewels** — secured, rotated, and never sitting in a script.
- **Cost-justified** — a lean tool that earns its place through a real CapEx/OpEx case.

## Design

I productionised **Unimus** — a vendor-agnostic Network Configuration Management platform —
as the automation backbone, and stood it up **ground-up**: install, device onboarding,
backup scheduling, and change workflows. It gave the fleet three things it never had from one
place: **automated, scheduled config backups**, **change tracking with config diffs**, and
**mass / bulk config push** across many devices at once.

Paired with it, **NetBox** served as the **IPAM and source-of-truth** for the device
inventory the automation runs against — so the fleet is driven from a single, accurate model
of what exists rather than tribal knowledge. Both are lean, community-rooted tools adopted
under a **corporate-supported licence**, which made them viable inside an enterprise change
process — the open-source-into-corporate pattern, done properly.

## Security & reliability decisions

- **Centralised, vaulted credentials with rotation** — the network's secrets live in one
  scoped, rotated place, never embedded in scripts or shared by hand.
- **Config backup = real network DR** — every device restorable from a known-good config.
- **Diffs + auditing** — every configuration change is visible, attributable, and reversible.
- **Source-of-truth driven** — automation acts on NetBox's model, not on guesswork.

## Outcome

The switch fleet across AU/NZ/PNG was maintained from a single pane: configs backed up
automatically, bulk changes pushed in minutes instead of days, credentials secured and
rotated, and — for the first time — a genuine recovery path for network configuration. A lean
community toolset, productionised with enterprise rigour.

## Future improvements

Drive the automation deeper from the source-of-truth — intent in NetBox, pushed to the fleet
through Unimus — and template standard site configs so a new location onboards straight from
the inventory.
